go/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2026-06-20 00:15:59 +02:00
Code Issues Releases Activity
1,409 Commits 4 Branches 67 Tags
master
Commit Graph
1409 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Joeseph Grey caf8857bbd fix(G404): flag missing math/rand weak-random functions (#1694) 2026-06-15 10:44:27 +02:00
renovate[bot] cbef395cb1 Update all dependencies (#1695) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-15 10:30:24 +02:00
renovate[bot] f1c81de5fc Update all dependencies (#1693) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-08 10:14:34 +02:00
Cosmin Cojocar 9addc97cef Update to go version 1.26.4 and 1.25.11 (#1690) 
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
 2026-06-03 17:48:52 +02:00
Cosmin Cojocar 92ed8df328 Update the gosec in the Github action to v2.27.1 (#1688) 
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
 2026-06-01 20:53:11 +02:00
Ludovic Fernandez 9e6a9843d7 Downgrade google lib to avoid min Go version bump (#1687) v2.27.1 2026-06-01 19:11:18 +02:00
Cosmin Cojocar 0a5c6504c4 Downgrade the jsonschema dep to v0.13.0 due to incompatibility with anthropick-sdk-go (#1686) 
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
v2.27.0 		2026-06-01 10:12:49 +02:00
renovate[bot] b48e668764 Update all dependencies (#1685) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-01 09:48:00 +02:00
Cosmin Cojocar bd17b2589e Downgrade the github.com/invopop/jsonschema v0.13.0 to solve incopatibility with anthropic-sdk (#1683) 
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
 2026-05-26 21:48:51 +02:00
renovate[bot] c6f8c3d9a7 Update all dependencies (#1682) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-05-26 20:41:32 +02:00
Cosmin Cojocar 5676cbccda Update vulnerabilities alerts for indirect dependencies 
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
 2026-05-26 20:31:35 +02:00
renovate[bot] ce167d4a37 Pin dependencies (#1681) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-05-26 20:23:17 +02:00
Cosmin Cojocar 74b726dfce Skip pining for my repos 
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
 2026-05-26 20:15:02 +02:00
Cosmin Cojocar a68f8825bf Update renovate configuration 
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
 2026-05-26 19:56:47 +02:00
Cosmin Cojocar 2f8791bad7 Fix typo 
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
 2026-05-26 17:37:07 +00:00
Cosmin Cojocar ad3778a7be Update branch config in renovate config 
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
 2026-05-26 17:34:47 +00:00
renovate[bot] b1583fe2f3 Migrate config renovate.json (#1678) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-05-26 19:30:41 +02:00
Cosmin Cojocar 139e33d474 Update renovate to refresh the branch creation 
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
 2026-05-26 17:27:58 +00:00
Cosmin Cojocar f3c03ebb7f Update the renovate branch prefix 
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
 2026-05-26 17:13:06 +00:00
Cosmin Cojocar 85814f2e39 Update renovate config to pin the actions dependencies by digests (#1676) 
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
 2026-05-26 18:51:53 +02:00
Cosmin Cojocar 55f0519732 Migrate the html remport to react v19. (#1675) 
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
 2026-05-26 18:33:30 +02:00
Cosmin Cojocar 6ad4476d26 Manually update version to fix renovate (#1674) 
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
 2026-05-26 18:07:55 +02:00
lucaszhu-hue 8f88312a5f feat: integrate Atlas Cloud provider (#1672) 
* feat: integrate Atlas Cloud provider

* Update .env.example for review feedback

* Update README.md for review feedback

* Update autofix/ai.go for review feedback

* Update autofix/atlas.go for review feedback

* Update autofix/atlas_test.go for review feedback

* Update cmd/gosec/main.go for review feedback

* Remove temporary Atlas review document

* Fix lint in autofix atlas tests

* docs: add Atlas Cloud README intro
 2026-05-26 17:42:02 +02:00
Jim Liu 6351b0c6fc Refactor error position parsing to support path with colon. (#1673) 
* Refactor error position parsing to support path with colons

* Add additional unit test for paths with colons

* Fix lint warnings.

* Add length check to protect against potential API change of FindStringSubmatch()
 2026-05-21 14:40:17 +02:00
Cosmin Cojocar de65614d10 Add two options to require rule ID and justificaiton for inline annotations (#1671) 
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
 2026-05-11 22:06:17 +02:00
Cosmin Cojocar e354c572d9 Fix false positive in G118 when cancel is stored in a slice/map (#1670) 
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
 2026-05-11 21:00:26 +02:00
Cosmin CojocarandClaude Opus 4.7 4161f0b433 chore(go): update supported Go versions to 1.25.10 and 1.26.3 (#1669) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-11 20:29:31 +02:00
Cosmin Cojocar b4f2934756 Harden the github workflows and action (#1665) 
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
 2026-05-04 20:10:35 +02:00
Ville Skyttä b7aca26886 Fix justification delimiter in annotation format doc (#1661) 2026-05-04 18:17:31 +02:00
renovate[bot] 945bce72d2 Update all dependencies (#1664) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-05-04 18:15:22 +02:00
Cosmin Cojocar 5f4eec95fa Update action to use gosec version v2.26.1 (#1660) 
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
 2026-04-28 09:32:42 +02:00
Cosmin Cojocar 4a3bd8af17 Update cosign to v3.0.6 (#1659) 
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
v2.26.1 		2026-04-28 08:44:21 +02:00
Ravi Sastry Kadali 553d8a5050 Sync taint rule docs and add missing CWE mappings for G113/G307 (#1658) 
Update README and DEVELOPMENT to list G707-G710 alongside the existing
taint rules. Add CWE-444 for G113 (HTTP request smuggling) and CWE-276
for G307 (os.Create permissions) so issues from those rules carry a CWE
weakness instead of nil. Fix a 'falg1' typo in flag_test that prevented
the validated-flag test from binding the flag it was meant to exercise.
v2.26.0 		2026-04-27 08:27:57 +02:00
renovate[bot] bf0ccd3df8 Update all dependencies (#1657) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-04-27 08:27:03 +02:00
Ravi Sastry Kadali 4ead098510 Add G710 rule for open redirect via taint analysis (#1654) 2026-04-26 09:38:45 +02:00
Cosmin Cojocar 8ff985fe09 Fix formatting 
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
 2026-04-25 11:31:48 +02:00
Cosmin Cojocar a1aad0cd00 Update the default models use by autofix and phase out the older models 
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
 2026-04-25 11:31:48 +02:00
Cosmin Cojocar 74bdf7f880 Format and clean-up the README 
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
 2026-04-25 11:31:48 +02:00
Cosmin Cojocar 74dc9893d6 Add HTTP file-serving function to the skins of pathtraversal analyzer (#1647) 
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
 2026-04-25 10:37:00 +02:00
Cosmin Cojocar 70201119fe Skip flaging the TLS min version for go 1.18+ (#1646) 
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
 2026-04-25 10:06:56 +02:00
dependabot[bot] d5869fccbc chore(deps): bump go.opentelemetry.io/otel from 1.39.0 to 1.41.0 (#1645) 
Bumps [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) from 1.39.0 to 1.41.0.
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.39.0...v1.41.0)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.41.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-25 10:02:12 +02:00
Cosmin Cojocar 24ee992e95 Added filepath.Abs as a sanitizer (#1643) 
it calls Clean internally per Go docs.

Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
 2026-04-23 15:25:57 +02:00
Cosmin Cojocar 87bdc09bee Allow rune to byte conversion (#1642) 
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
 2026-04-23 09:21:59 +02:00
Cosmin Cojocar 73293bde6b Allow platform specific conversions (#1641) 
Allow platform conversion such as uintptr -> int since are a common
pattern and they are safe.

Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
 2026-04-23 08:43:29 +02:00
renovate[bot] c864f68365 chore(deps): update all dependencies (#1639) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-04-20 07:57:34 +02:00
renovate[bot] 64b97151cd chore(deps): update all dependencies (#1634) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-04-13 10:44:48 +02:00
Cosmin CojocarandClaude Opus 4.6 2687376596 chore(go): update supported Go versions to 1.25.9 and 1.26.2 (#1633) 
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
 2026-04-10 17:44:55 +02:00
Ravi Sastry Kadali b4c4d0b589 Fix: Bump go-version: 1.25.8 to 1.25.9 in ci (#1632) 2026-04-10 10:23:28 +02:00
Ravi Sastry Kadali baf0dcfbec fix(taint): gate *http.Request auto-taint on entry-point detection (#1630) 
* fix(taint): gate *http.Request auto-taint on entry-point detection (#1629)

isParameterTainted unconditionally tainted any *http.Request parameter by
type, even when the function had known callers passing constant-URL requests.

Check the CHA call graph first: only auto-taint when the function has no
in-edges (true external entry point). When callers exist, fall through to
the existing caller-verification loop instead.
Fixes #1629

* Address Barry AI Security Analysis

* improve code coverage

* fix lint

* taint mechanism, framework agnostic

* address lint warning
 2026-04-08 11:31:24 +02:00
renovate[bot] fa4824cb29 chore(deps): update all dependencies (#1631) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-04-07 13:45:23 +02:00